CoChat
Sign Up
Cited by 261Smart Grid Security and ResilienceIndustrial Automation and Control SystemsNetwork Security and Intrusion Detection

Architecture and security of SCADA systems: A review

Open access
Yadav, Geeta, Paul, Kolin·2021·International Journal of Critical Infrastructure Protection
DOI 10.1016/j.ijcip.2021.100433
Open this paper in CoChat — free accountOpen PDF

Abstract

Pipeline bursting, production lines shut down, frenzy traffic, trains confrontation, nuclear reactor shut down, disrupted electric supply, interrupted oxygen supply in ICU - these catastrophic events could result because of an erroneous SCADA system/ Industrial Control System(ICS). SCADA systems have become an essential part of automated control and monitoring of many of the Critical Infrastructures (CI). Modern SCADA systems have evolved from standalone systems into sophisticated complex, open systems, connected to the Internet. This geographically distributed modern SCADA system is vulnerable to threats and cyber attacks. In this paper, we first review the SCADA system architectures that have been proposed/implemented followed by attacks on such systems to understand and highlight the evolving security needs for SCADA systems. A short investigation of the current state of intrusion detection techniques in SCADA systems is done , followed by a brief study of testbeds for SCADA systems. The cloud and Internet of things (IoT) based SCADA systems are studied by analysing the architecture of modern SCADA systems. This review paper ends by highlighting the critical research problems that need to be resolved to close the gaps in the security of SCADA systems.

AI snapshot

Written from the paper’s full text.

TL;DR

This review interconnects SCADA architectures, communication protocols, attacks, intrusion detection systems, testbeds, and IoT/cloud trends to highlight evolving security needs. It concludes that despite many IDS and testbed approaches, gaps remain in datasets, validation, latency metrics, scalable testbeds, and secure IoT-cloud SCADA.

Key findings

  • SCADA has evolved through four generations—monolithic, distributed, networked, and IoT/Industry 4.0—with modern systems using open protocols and Internet/cloud connectivity, increasing exposure to cyber-attacks.
  • Analysis of the RISI database found 242 recorded incidents from 1982–2017; the USA and UK were most affected; 91 attacks were reported during 2008–2012; the highest annual count was 36 in 2003; transportation had 48 attacks and power/utilities 46; about 28% of reported attacks were malware; 20% of critical infrastructure attacks were unknown; organized hacking groups caused 5%.
  • Protocol security varies: Modbus has no encryption or authentication control; DNP3-SA and Profibus support encryption and authentication control; IEC 60870-5-101 and IEC 61850 do not support encryption but allow authentication control.
  • IDSs are classified by information source (HIDS/NIDS) and analysis strategy (signature, anomaly, specification, machine learning); one probabilistic clustering approach reported average precision of 98% in recognizing critical states. Testbeds are categorized as physical, virtual, virtual-physical/HIL, and hybrid, with tradeoffs in fidelity, cost, and scalability.

Methods

  • Narrative review: searched top conferences and journals and databases including IEEE Xplore, ACM, IET, and SCOPUS; manually categorized papers by IDS, testbeds, and attack analysis; proposed a taxonomy linking SCADA architecture, protocols, vulnerabilities, IDS, testbeds, and IoT-cloud systems.
  • Analyzed the RISI database and reported attacks chronologically, classifying attacks into malware, non-cyber attack, unauthorized remote access, interruption of service, and unknown; reviewed IDS techniques and testbed types.

Limitations

  • Stated: lack of complete and validated SCADA attack datasets; no comprehensive global dataset covering all attacks; RISI not updated since 2015; many attacks are unreported; testbed development is costly and no testbed is simultaneously cost-efficient, scalable, and high-fidelity; IDS validation often omits time-to-detect; cryptographic approaches were kept out of scope due to resource-constrained devices.
  • Stated: RISI completeness depends on which nations report attacks, and 20% of critical infrastructure attacks are unknown.
  • Evident from the text: the review is narrative rather than systematic, with no formal inclusion/exclusion counts or quality appraisal; several comparative tables are incomplete or truncated in the provided text, limiting reproducibility.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1016/j.ijcip.2021.100433

Cites

Statistics

Nothing to recompute.

Claims the paper makes

0 of 78 cited sources checked · 0 supported · 0 flagged

  • Findingcitation

    The RISI database contains 242 incidents recorded from 1982 to 2017.

    “In 2017, the Repository of Industrial Security Incidents (RISI) database [42], a publicly available online database, contains 242 incidents that are recorded from 1982 to 2017.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [42] Chen, 2015, Implementing attacks for modbus/TCP protocol in a real-time cyber physical system test bed

      Not checked in the free run.

  • Findingown data

    The USA and UK are the countries most affected by cyber-attacks, based on the number of reported attacks vs country.

    “The result of the analysis in Fig. 9 number of reported attacks vs country shows that the USA and UK are the countries most affected by cyber-attacks.”
    Quote in the paperNot a substantial claim
  • Findingown data

    After 2003, there is a decrease in the count of attacks.

    “However, after that, there is a decrease in the count of attacks.”
    Quote in the paperNot a substantial claim
  • Findingown data

    Organised hacking groups cause 5% of the reported attacks.

    “Organised hacking groups cause 5% of the reported attack.”
    Quote in the paperNot a substantial claim
  • Findingown data

    Approximately 28% of the reported attacks are due to malware attack.

    “Fig. 12 shows that approximately 28% of the reported attacks are due to malware attack.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. 106
  • May combine two claims. 43
  • The quote only partly states this claim. 3

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Unauthorised access is also another cause of many attacks.

    “Unauthorised access is also another cause of many attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Forty-eight attacks have been reported in the transportation sector, followed by 46 attacks in power and utilities.

    “Forty-eight attacks have been reported in the transportation sector which is followed by 46 attacks in power and utilities.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Most numbers of attacks, i.e., 91, have been published during 2008-2012, followed by 2003-2007.

    “Most numbers of attacks, i.e., 91 have been published during 2008 -2012 followed by 2003-2007.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingcitation

    According to the RISI repository, about 17 countries have one reported security attack per country.

    “According to RISI repository [42], about 17 countries have one reported security attack per country.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [42] Chen, 2015, Implementing attacks for modbus/TCP protocol in a real-time cyber physical system test bed

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Sixteen reported attacks do not mention the country name.

    “Sixteen reported attacks do not mention the country name.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    The highest number of attacks are reported in 2003 (36), most of which were due to malware attack.

    “The highest number of attacks are reported in 2003 (36), most of which were due to malware attack.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    There are seven countries which have two cyber-attacks per country.

    “There are seven countries which have two cyber-attacks per country.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    Datasets KDD99, NSS-KDD, and DARPA are outdated and not synchronised with modern SCADA architecture.

    “Datasets KDD99 [68], NSS-KDD [69], DARPA [70] are outdated and not synchronised with modern SCADA architecture.”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [68] Chan, 2013, On smart grid cybersecurity standardization: issues of designing with nistir 7628, IEEE Commun. Mag. source

      Not checked in the free run.

    • cites [69] Schuett, 2014, An evaluation of modification attacks on programmable logic controllers, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

    • cites [70] Basnight, 2013, Firmware modification attacks on programmable logic controllers, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    Knowledge-based IDSs are still not capable of handling zero-day attacks.

    “However, these systems are still not capable of handling zero-day attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingcitation

    NSTB consists of a complex electrical grid with sixty-one miles, distribution lines of 13.8KV, a transmission loop of 128KV, and approximately three thousand monitoring points.

    “NSTB consists of a complex electrical grid with sixty-one miles, distribution lines of 13.8KV, transmission loop of 128KV and approximately three thousand points for monitoring.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [113] Nivethan, 2016, A linux-based firewall for the dnp3 protocol

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    Knowledge-based IDSs are not reliable for unknown attacks.

    “The knowledge-based IDSs are not reliable for unknown attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingcitation

    Real-time monitoring, pay-per-use, licenses, and cheaper capital and operating expense are advantages offered by cloud service.

    “Real-time monitoring, Pay-per-use, licenses, cheaper capital and operating expense are the advantages offered by cloudservice [126].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [126] Hong, 2011, An intrusion and defense testbed in a cyber-power system environment, IEEE Power Energy Soc. Gen. Meet. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Virtual testbeds have the lowest degree of fidelity and reliability.

    “Virtual testbeds have the lowest degree of fidelity and reliability.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingcitation

    SCADA-SST is scalable, supports hybrid scenarios, is lightweight, and can be widely used in different SCADA systems.

    “The proposed testbed is scalable, support hybrid scenarios, lightweight and can be widely used in different SCADA systems.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [119] Emrah korkmaz, 2016, Industrial control system security testbed

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    A physical testbed is a costly operation.

    “It is also a costly operation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    The scalability and cost of a physical SCADA testbed is a great issue due to the need for hardware stacks.

    “The scalability and cost of the physical system is a great issue due to the need for hardware stacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingnone given

    Current SCADA frameworks use a combination of old and new features, due to which their security is in greater danger.

    “The current SCADA frameworks use a combination of characteristics of old and new features, due to which, their security is in greater danger.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Findingnone given

    Hardware-in-the-loop measurement is more realistic and cost-effective.

    “The measurement of HIL is more realistic and cost-effective.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingnone given

    The physical testbed has the highest degree of fidelity, but maintaining real hardware and software is challenging.

    “The physical testbed has the highest degree of fidelity but to maintain real hardware and software is a challenging task.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingcitation

    TASSCS uses the Opnet tool to simulate control networks and the PowerWorldi simulation system to simulate operation behaviour.

    “To simulate the control networks, e.g.Modbus, Allen-Bradley Data Highway, TASSCS uses Opnet tool and to simulate the operation behaviour; it uses PowerWorldi simulation system.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [106] Goldenberg, 2013, Accurate modeling of modbus/TCP for intrusion detection in SCADA systems, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • May combine two claims.

    Findingcitation

    The NVD dataset contains common vulnerabilities in all domains and fails to focus on SCADA-specific vulnerabilities.

    “NVD dataset [71] contains common vulnerabilities in all domains that fail to focus on SCADA specific vulnerabilities.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [71] Zhu, 2017, A methodology for determining the image base of arm-based industrial control system firmware, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Virtual testbeds are easy to develop.

    “However, they are easy to develop.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Findingnone given

    The SCADA system is generally inflexible, static, and follows a centralised architecture.

    “Generally, the SCADA system is inflexible, static and follows centralised architecture.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Findingnone given

    In IoT-cloud based systems, bandwidth overload and latency are a big issue.

    “In IoT-cloud based system, bandwidth overload and latency are a big issue.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Findingnone given

    Currently industries are shifting to cloud-based SCADA systems because they are economical and easily scalable.

    “Apart from this, currently industries are shifting to cloud-based SCADA systems as they are economical and easily scalable.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingreasoning

    Linux and Windows suffer from vulnerabilities due to the large source code for operating systems.

    “However, Linux and Windows suffer from their vulnerabilities due to the large source code for operating systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Cloud-based SCADA systems are hampered by performance issues, i.e., high latency and low bandwidth.

    “But cloud-based SCADA system is hampered by performance issues, i.e., high latency and low bandwidth.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Findingnone given

    IoT protocols used in SCADA lack reliability, raising the need for reliable communication protocols.

    “These protocols lack reliability, raising the need for reliable communication protocols.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Over the period, many attacks on SCADA industrial control systems have been reported.

    “Over the period, many attacks on SCADA industrial control system have been reported.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingcitation

    Kaspersky recently launched a secure operating system for SCADA that does not have traces of Linux.

    “Recently, Kaspersky launched a secure operating system for SCADA which does not have traces of Linux [135,136].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [135] E. Daalder, B.D. Manager, SCADA Cloud Computing, Technical Report, Yokogawa Electric Corporation Global SCADA Center.

      Not checked in the free run.

    • cites [136] Khan, 2020, A seamless cloud migration approach to secure distributed legacy industrial SCADA systems

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    In IoT based systems, a massive amount of data gets generated.

    “In IoT based system, a massive amount of data gets generated.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    Monolithic SCADA systems work in an isolated environment and do not have connectivity to other systems.

    “Monolithic SCADA systems: It refers to those systems which work in an isolated environment and do not have any connectivity to the other systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Many international institutes publish guidelines frequently for secure SCADA implementation.

    “Many international institutes e.g.IEEE, Centre for the Protection of National Infrastructure (CPNI), American Gas Association (AGA), Industrial Automation and Control System Security (ISA), North American Electric Reliability Corporation (NERC) and National Institute of Standards and Technology (NIST) etc. publish guidelines frequently for secure SCADA implementation [6].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [6] Pathak, 2014, Modern SCADA systems, Int. J. Eng. Dev. Res.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    Distributed SCADA systems are interconnected and confined inside small range networks like LAN.

    “Distributed SCADA systems: These systems were inter-connected and confined inside small range network like Local Area Networks (LAN) as shown in Fig. 7.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    Intrusion detection systems (IDSs) are used to detect and prevent attacks and recognise vulnerabilities in SCADA systems.

    “Intrusion detection systems (IDSs) are used to detect and prevent these attacks, and recognising vulnerabilities in the systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Security spillage in small networks can lead to loss of services and financial loss to the utility company.

    “Moreover, the security spillage in small networks can lead to a loss of services and financial loss to the utility company.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Security spillage in small networks can lead to loss of services and financial loss to the utility company.

  • May combine two claims. The quote only partly states this claim.

    Interpretationreasoning

    Testbeds play an important role in overcoming the lack of validated datasets and in deploying IDSs.

    “Therefore, the testbed plays an important role.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The SCADA architecture is classified into four generations: Monolithic, Distributed, Networked, and IoT-based fourth generation.

    “The SCADA architecture is classified into four generations, i.e.Monolithic, Distributed, Networked, and IoT based fourth generation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    A cyber-attack on a nuclear plant will have a global impact.

    “A cyber-attack on a nuclear plant will have a global impact.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: A cyber-attack on a nuclear plant will have a global impact.

  • Classified as probably not a substantial claim.

    Premisereasoning

    Deploying IDSs on a running SCADA system is challenging because critical infrastructure cannot bear shutdown or delay.

    “Apart from that, deploying these IDSs on a running SCADA system is a challenging task as these are part of critical infrastructure which cannot bear a shutdown, delay etc.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    The modernisation of SCADA, standardisation of communication protocols and growing interconnectivity have drastically increased cyber-attacks on SCADA systems over the years.

    “The modernisation of the SCADA system, standardisation of communication protocols and growing interconnectivity have drastically increased the cyber-attacks on SCADA system over the years.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The modernisation of SCADA, standardisation of communication protocols and growing interconnectivity have drastically increased cyber-attacks on SCADA systems over the years.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Premisenone given

    An analysis of attacks on SCADA systems is necessary to develop technology for handling new attacks.

    “An analysis of attacks on SCADA system is necessary to develop technology for handling new attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Most IDS tools need to be trained and tested on a relevant and validated dataset, which will be unique for each industry and each SCADA system.

    “Most of IDS tools need to be trained and tested on a relevant and validated dataset, which will be unique for each industry and each SCADA system.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Distributed SCADA systems distribute computation overhead on remotely located systems using LAN, resulting in more processing power, redundancy, and reliability.

    “This generation distributes the computation overhead on remotely located systems using LAN, i.e., some of the systems work as communications processors, some Figure 4: Interrelation of SCADA system components (inspired by [7]) as operator interfaces, some as a database server, etc. [9], resulting in more processing power, redundant, and reliable system.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [9] Feng, 2019, A systematic framework to generate invariants for anomaly detection in industrial control systems

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    CoAP is a specialized Internet Application Protocol and is a replacement of HTTP for resource constraint IoT based devices.

    “CoAP, a specialized Internet Application Protocol, is an replacement of HTTP for resource constraint IoT based devices [36, 37].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [36] Schwarz, 2013, A survey on OPC and OPC-UA: About the standard, developments and investigations

      Not checked in the free run.

    • cites [37] 2014, Interoperability between OPC UA and automationml, Procedia CIRP source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Security of SCADA systems was not of concern in distributed SCADA systems.

    “Security of SCADA systems was not of concern.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Profibus protocol is most popularly used in discrete manufacturing and process control.

    “Profibus is most popularly used in discrete manufacturing and process control [7].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [7] Edvard, 3 generations of SCADA system architectures you should know about, 2013, http://electrical-engineering-portal.com/three-generations-of-scada-system-architectures.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    IEC 61850 is generally used in electrical substations for communication among intelligent electronic devices.

    “IEC 61850 is generally used in electrical substations for communication among intelligent electronic devices [26].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [26] U. Perera, Comparisons of SCADA communication protocols for power systems, 2015, https://www.linkedin.com/pulse/comparisons-scada-protocols-power-systems-udara-perera.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    BLE is 2.5 times energy efficient than Zigbee.

    “BLE is 2.5 times energy efficient than Zigbee [31].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [31] W.Colitti, K.Steenhaut, N.DeCaro, B.Buta, V.Dobrota, Evaluation of constrained application protocol for wirelesssensor networks (2011). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Modbus is mainly utilised for applications where the volume of information exchange is low.

    “Modbus is, for the most part, utilised for applications where the volume of information exchange is low [19].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [19] Marian, 2020, Experimenting with digital signatures over a dnp3 protocol in a multitenant cloud-based SCADA architecture, IEEE Access source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A typical Modbus network supports one master and a maximum of 247 slaves.

    “A typical Modbus network supports one master and a maximum of two hundred forty-seven slaves.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [22] P. Xin, IEC 61850 testing and documentation, 2010,https://www.theseus.fi/bitstream/handle/10024/17035/Peng_Xin.pdf.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    IEC 61850 protocol was developed by the IEC Technical Committee 57.

    “The International Electro-Technical Commission(IEC) 61850 protocol was developed by the IEC Technical Committee 57 [26].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [26] U. Perera, Comparisons of SCADA communication protocols for power systems, 2015, https://www.linkedin.com/pulse/comparisons-scada-protocols-power-systems-udara-perera.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The significant game-changing improvement in networked SCADA was the use of Internet Protocol for communication between MTU and RTUs, resulting in disaster survivability.

    “The significant game-changing improvement in networked SCADA was the use of Intenet Protocol for the communication between MTU and RTUs, resulting in disaster survivability.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Networked SCADA systems use open protocols and standards for communication rather than proprietary protocols, distributing MTU functionality across a WAN.

    “However, Networked SCADA is closely related to that of Distributed SCADA, with the significant difference in the usage of open protocols and standards for communication rather than proprietary protocols resulting in distributing MTU functionality across a WAN also as shown in Fig. 6.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [9] Feng, 2019, A systematic framework to generate invariants for anomaly detection in industrial control systems

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    IEC 61850 abstract data models can be mapped to many other protocols, e.g., MMS, GOOSE, and SMV.

    “Moreover, IEC 61850 abstract data models can be mapped to many other protocols, e.g.MMS, GOOSE, and SMV [29].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [29] Markovic-Petrovic, 2013, Analysis of SCADA system vulnerabilities to DDOSattacks

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    Using predictive maintenance, downtimes can be reduced, increasing production of the system.

    “However, using predictive maintenance, these downtimes can be reduced, increasing the production of the system [17].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [17] Mahapatra, 2015, Analysis of vulnerabilities in the protocols used in SCADA systems, Int. J. Adv. Res.Comput. Eng. Technol.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    DNP3 protocol was developed to obtain open and standards-based interoperability between RTUs, MTU, and PLC.

    “The motive for DNP3 protocol development was to obtain open and standards-based interoperability between RTUs, MTU, and Programmable Logic Controller(PLC).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [7] Edvard, 3 generations of SCADA system architectures you should know about, 2013, http://electrical-engineering-portal.com/three-generations-of-scada-system-architectures.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The number of security-related attacks on SCADA systems has drastically increased recently.

    “Recently, the number of security-related attacks on SCADA system has drastically increased.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    SCADA systems are expected to run without interruption, so any patch or upgrade cannot be applied without compromising productivity.

    “These systems are expected to run without any interruption, so any patch or upgrade cannot be applied without compromising its productivity [32,33].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [32] Z. Shelby, K. Hartke, C. Bormann, The constrained application protocol (coap)(2014). source

      Not checked in the free run.

    • cites [33] P. Sethi, S.R. Sarangi, Mq telemetry transport (mqtt) v3. 1 protocolspecification (2010).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    20% of the attacks on critical infrastructure are unknown.

    “Moreover, 20% of the attacks on critical infrastructure are unknown [51].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [51] Langner, 2011, Stuxnet: dissecting a cyberwarfare weapon, IEEE Secur. Privacy source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    With time, attackers have started using more sophisticated techniques to compromise the security of SCADA systems, so the threats are increasing.

    “With time, attackers have started using more sophisticated techniques to compromise the security of SCADA systems than ever, so the threats are increasing.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Most SCADA communication happens on wireless networks, making them vulnerable to network security attacks.

    “Moreover, most of the communication happens on the wireless network, which makes it vulnerable to network security attacks [35].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [35] Slay, 2007, Lessons learned from the maroochy water breach, IFIP Int. Feder. Inf.Process.

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning

    PLC, MTU, and RTUs still use legacy SCADA software and are restricted from updates, making them prone to well-known vulnerability exploitations.

    “PLC, MTU, and RTUs still uses legacy SCADA software, and are restricted to update.Therefore, these are even prone to well-known vulnerabilities exploitations.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The number of attacks against SCADA systems doubled in 2014 on a year-to-year basis.

    “As per the Dell annual report [52], the number of attacks against SCADA systems doubled in 2014 on the year-to-year basis.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [52] Lee, 2014, German steel mill cyber attack, Ind. Control Syst.

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    The architecture and design of SCADA systems are available in patents or publications, making them accessible to hackers.

    “The architecture and design of SCADA systems are available in the form of patents or publications, which make it accessible to hackers [34].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [34] Falliere, 2011, W32.stuxnet dossier, Symantec-Security Response Version 1.

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    SCADA systems are geographically distributed, and hence their physical security is a significant issue.

    “SCADA systems are geographically distributed.Hence their physical security is a big issue [32,33].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [32] Z. Shelby, K. Hartke, C. Bormann, The constrained application protocol (coap)(2014). source

      Not checked in the free run.

    • cites [33] P. Sethi, S.R. Sarangi, Mq telemetry transport (mqtt) v3. 1 protocolspecification (2010).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    There is a drastic increase in the count of cyber-attacks over the years.

    “Miller and Row in [4], analysed that there is a drastic increase in the count of cyber-attacks over the years.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [4] Miller, 2012, A survey SCADA of and critical infrastructure incidents

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning

    Researchers are creating testbeds for SCADA systems to overcome the deficiency of well-validated datasets for the verification of IDSs.

    “Researchers are creating testbeds for the SCADA systems to overcome the deficiency of well-validated datasets for the verification of IDSs.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Premisecitation

    The present research is still lacking practical approach.

    “However, the present research is still lacking practical approach [116].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [116] Morris, 2011, A testbed for SCADA control system cybersecurity research and pedagogy

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Traditionally, IDS is designed to detect a fixed type of attack, i.e., DOS, routing attack.

    “Traditionally, IDS is designed to detect a fixed type of attack, i.e., DOS, routing attack.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisereasoning

    These type of event need substantial financial investments.

    “These type of event need substantial financial investments.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    KDD99 includes redundant and duplicate instances.

    “It also includes redundant and duplicate instances.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisereasoning

    Signature detection is effective to detect known attacks, but it fails to detect new attacks due to the absence of signatures of new or variants of known attacks.

    “This technique is effective to detect known attacks, but it fails to detect new attacks due to the absence of signature of new or variants of known attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning

    Once the specification is set up, it can start functioning without the need for training.

    “Once the specification is set up, it can start functioning without the need for training.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    An improved version of the DARPA dataset, including suggestions by computer security communities, was released in 1999.

    “However, in 1999, an improved version of this dataset which includes suggestion by computer security communities was released”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning

    A re-sampled version of KDD dataset, NSS-KDD, was created.

    “Therefore, a re-sampled version of KDD dataset, NSS-KDD [69] dataset was created.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [69] Schuett, 2014, An evaluation of modification attacks on programmable logic controllers, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    IDSs need training and validation data sets for analysing system behaviour.

    “Generally, for analysing system behaviour, IDSs need training and validation data sets”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    NIDS provide real-time detection, and it is hard to remove evidence of NIDS.

    “Moreover, NIDS provide real-time detection, and it is hard to remove evidence of NIDS.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    A lot of theoretical security approaches have been presented in the last few years.

    “A lot of theoretical security approaches have been presented in the last few years.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Premisecitation

    Convolutional neural networks work better for anomaly detection as compared to other classification algorithms.

    “Their research demonstrates that ID convolutional neural networks work better for anomaly detection as compared to other classification algorithms.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [96] Yang, 2019, Deep-learning-based network intrusion detection for SCADA systems

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The research work for IDSs suffers from the lack of datasets for the verification of the functionality of their algorithms.

    “The research work for the IDSs suffers from the lack of datasets for the verification of the functionality of their algorithms.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Anomaly detection systems can work efficiently if the traffic is regulated and has predictable behavior.

    “Anomaly detection systems can work efficiently if the traffic is regulated and have predictable behavior [83].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [83] Yang, 2011, Impact of cyber-security issues on smart grid

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The presented algorithm approaches an average precision of 98% in recognizing the critical states.

    “The presented algorithm approaches an average precision of 98% in recognizing the critical states.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [88] P. Oman, M. Phillips, Intrusion Detection and Event Monitoring in SCADA Networks, Springer, Boston, US, MA, pp. 161–173. 10.1007/978-0-387-75462-8_12. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    HIDS provides approximate real-time intrusion detection without requiring extra equipment.

    “HIDS provides approximate real-time intrusion detection without requiring extra equipment.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisenone given

    Signature detection can achieve good accuracy for intrusion detections, which depends on the correctness of the misuse pattern.

    “This approach can achieve a good accuracy for intrusion detections which depends on the correctness of the misuse pattern.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The first DARPA dataset, simulated over an air force base, was published by MIT Lincoln Lab in 1998.

    “The first DARPA dataset, simulated over an air force base, was published by MIT Lincoln Lab in 1998 [70].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [70] Basnight, 2013, Firmware modification attacks on programmable logic controllers, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The DARPA dataset provides raw host and network data which need to be preprocessed to use for verifying machine learning IDSs.

    “This dataset provides raw host and network dataset which need to be preprocessed to use for verifying machine learning IDSs.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    KDD99 is widely used dataset since 1999 for the evaluation of IDSs.

    “KDD99 [68] is widely used dataset since 1999 for the evaluation of IDSs.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [68] Chan, 2013, On smart grid cybersecurity standardization: issues of designing with nistir 7628, IEEE Commun. Mag. source

      Not checked in the free run.

  • May combine two claims.

    Premisenone given

    Probabilistic model-based techniques can distinguish between normal and critical states and remove the requirement for domain experts.

    “Based on its analysis, it can distinguish between normal and critical states and removes the requirement for domain experts.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Till now, attackers have mainly focused on high-level systems, i.e., HMI and communication protocols.

    “Till now, attackers have mainly focused on high-level systems, i.e., HMI and communication protocols.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    KDD99 does not include analytical or experimental validation of data's false alarm characteristics.

    “However, this dataset does not include analytical or experimental validation of data's false alarm characteristics.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisereasoning

    Most security approaches need empirical data to train and test the system, and in SCADA systems these approaches fail due to lack of real empirical operational data.

    “Most of the security approaches need empirical data to train and test the system, In case of SCADA systems, these approaches fails due to lack of real empirical operational data.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The access to this testbed is restricted to the research community and academia.

    “Moreover, the access to this testbed is restricted to the research community and academia.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The National SCADA Testbed (NSTB), developed by the United States Department of Energy in Idaho National Labs, is an example of full-scale physical models.

    “The National SCADA Testbed (NSTB) [113] developed by United States Department of energy in Idaho National Labs(INL)is an example of full-scale physical models.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [113] Nivethan, 2016, A linux-based firewall for the dnp3 protocol

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    Hybrid testbeds are preferred because they have good accuracy and are cost-effective.

    “Now, hybrid testbeds are preferred because they have good accuracy and cost-effective.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given

    The main focus of a hybrid testbed is to provide a testbed for cyber-security purposes.

    “The main focus of Hybrid testbed is to provide a testbed for the cyber-security purpose.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given

    A virtual testbed isolates activities in the test environment from physical devices and external components.

    “The virtual testbed is developed to overcome the limitations of the software as well as physical testbed as it isolates activities in the test environment from the physical devices and the external components.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    Modern SCADA include many resource-constrained devices, which render cryptographic solutions inappropriate.

    “There are many cryptographic approaches discussed in the research community, but we kept it out of scope for our review, as modern SCADA include a lot of resource constraint devices, which render the cryptographic solutions inappropriate.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Security risks in the traditional system will be carried forward owing to communication protocols such as Modbus/TCP, IEC 40, and DNP3, which suffer from lack of protection.

    “The security risks in the traditional system will be carried forward owing to the communication protocols used like Modbus/TCP, IEC 40, and DNP3 which are suffering from lack of protection.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A HIL SCADA testbed [108] is a hybrid model.

    “Hybrid model”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [108] S. D’Antonio, F. Oliviero, R. Setola, High-Speed Intrusion Detection in Support of Critical Infrastructure Protection, , Berlin, Heidelberg, pp. 222–234. 10.1007/11962977_18. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The IDS in [89] uses anomaly detection.

    “Anomaly”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [89] Yang, 2013, Rule-based intrusion detection system for, SCADA networks

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    The security, analytics, storage, and complexity of IoT-generated data are the principal concern.

    “Therefore, the security, analytics, storage, and complexity of this data are the principal concern.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Due to IoTization and cloud-based SCADA, the research problems for secure SCADA have been widened.

    “Due to the IoTization and cloud-based SCADA, the research problems for secure SCADA has been widened.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given

    Scalability is a big issue for physical testbeds.

    “Scalability is a big issue.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationnone given

    Virtual testbeds are cost efficient and reliable.

    “Cost efficient and reliable”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Detection systems can use signature, specification, behaviour, or machine learning based models for enhanced security.

    “These detection systems can use signature, specification, behaviour or machine learning based models for the enhanced security.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premiseown data

    TASSCS [106] is a virtual testbed.

    “virtual testbed”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [106] Goldenberg, 2013, Accurate modeling of modbus/TCP for intrusion detection in SCADA systems, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The IDS in [89] uses time-stamp and IP address as input data.

    “Time-stamp, Ip address”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [89] Yang, 2013, Rule-based intrusion detection system for, SCADA networks

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The IDS in [86] handles DoS.

    “DoS”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [86] Flosbach, 2019, Architecture and prototype implementation for process-aware intrusion detection in electrical grids

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S1 (asserted), S3 (load-bearing), S4 (based).

    Premisecitation

    Cyber security backdrop [105] uses Modbus/TCP protocol.

    “Modbus/TCP”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [105] Krauß, 2016, Ontology-based detection of cyber-attacks to SCADA-systems in critical infrastructures

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation

    Integration of IoT-cloud in traditional SCADA systems offers new vulnerabilities and opportunities to share data, information, and services over the web.

    “Integration of IoT-cloud in traditional SCADA system offers new vulnerabilities and opportunities to share data/information/services over the web [139].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [139] Patel, 2017, Autonomic computing architecture for SCADA cyber security, Int. J. Cognit. Inform. Nat. Intell.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Cyber security backdrop [105] is a virtual testbed.

    “virtual testbed”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [105] Krauß, 2016, Ontology-based detection of cyber-attacks to SCADA-systems in critical infrastructures

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premiseown data

    Testbed for cyber-power system setting [107] is a virtual testbed.

    “virtual testbed”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [107] Cuppens-Boulahia, 2008, An ontology-based approach to react to network attacks

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given

    Physical testbeds have excellent reliability.

    “Excellent reliability.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Delay in decision making, i.e., latency delay, can cause a loss of production.

    “Delay in decision making, i.e., latency delay can cause a loss of production.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The IDS in [90] uses simulated data.

    “Simulated Data.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [90] Genge, 2015, Experimental assessment of network design approaches for protecting industrial control systems, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    There is an urgency for securing SCADA systems.

    “Therefore, there is an urgency for securing SCADA systems.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Most industries do not report cyber-attacks on their control system or SCADA for the sake of their reputation.
    • Rests on an assumption: The impact of attacks on SCADA systems can vary up to loss of human life.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    Despite many approaches for IDS and testbeds, there is still a lot of scope for further improvements.

    “This review indicates that despite a lot of approaches present for IDS, and testbeds, there is still a lot of scope for further improvements.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Testbed for cyber-power system setting [107] uses DNP3 protocol.

    “DNP3”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [107] Cuppens-Boulahia, 2008, An ontology-based approach to react to network attacks

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    SCADA systems have evolved into sophisticated complex open systems based on advanced technology systems connected to the Internet.

    “SCADA systems have evolved into sophisticated complex open systems based on advanced technology systems connected to the Internet.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S1 (asserted), S3 (load-bearing), S4 (based).

    Premisecitation

    TASSCS [106] uses Modbus protocol.

    “Modbus”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [106] Goldenberg, 2013, Accurate modeling of modbus/TCP for intrusion detection in SCADA systems, Int. J. Crit. Infrastruct.Prot. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    VSSCADA demonstrated their approach by simulating real-world critical infrastructures.

    “They also demonstrated their approach by simulating real-world critical infrastructures.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [117] F. Sauer, M. Niedermaier, S. Kieling, D. Merli, Licster a low-cost ICS security testbed for education and research (2019). 10.14236/ewic/icscsr19.1. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Physical-virtual testbeds have a high degree of fidelity.

    “High degree of fidelity.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Physical-virtual testbeds are moderate cost-efficient.

    “Moderate cost-efficient.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Interpretationnone given

    Scalability is a big issue for physical-virtual testbeds.

    “Scalability is a big issue.”
    Quote in the paperNot a substantial claim
125 of 125

  • The paper relies on this without support.

    The surveys published so far discuss and detail only one aspect of SCADA security and fail to show interconnections between various dimensions.

    “The surveys published so far discuss and detail only one aspect of the SCADA security and thus fail to the show the interconnections between various dimension that is essential to design security mechanisms for the Figure 2: Relation between different dimensions of SCADA security complex IIoT systems of the future.”

  • The paper relies on this without support.

    SCADA systems have become an essential part of automated control and monitoring of many Critical Infrastructures.

    “SCADA systems have become an essential part of automated control and monitoring of many of the Critical Infrastructures (CI).”

  • The paper relies on this without support.

    Modern SCADA systems have evolved from standalone systems into sophisticated complex, open systems, connected to the Internet.

    “Modern SCADA systems have evolved from standalone systems into sophisticated complex, open systems, connected to the Internet.”

  • The paper relies on this without support.

    The modernisation of SCADA, standardisation of communication protocols and growing interconnectivity have drastically increased cyber-attacks on SCADA systems over the years.

    “The modernisation of the SCADA system, standardisation of communication protocols and growing interconnectivity have drastically increased the cyber-attacks on SCADA system over the years.”

  • The paper relies on this without support.

    A cyber-attack on a nuclear plant will have a global impact.

    “A cyber-attack on a nuclear plant will have a global impact.”

  • The paper relies on this without support.

    Security spillage in small networks can lead to loss of services and financial loss to the utility company.

    “Moreover, the security spillage in small networks can lead to a loss of services and financial loss to the utility company.”

  • The paper relies on this without support.

    SCADA communication protocols play a pivotal role in MTU-RTU interactions.

    “SCADA communication protocols play a pivotal role in MTU-RTU interactions.”

  • The paper relies on this without support.

    To support interoperability and cost efficiency, some open standards were presented.

    “Therefore, to support interoperability and cost efficiency, some open standards were presented.”

  • The paper relies on this without support.

    Modbus is the most commonly used protocol for connecting electronic devices due to being openly published and easy to use.

    “It is the most commonly used protocol for connecting the electronic devices due to openly published and easy to use.”

  • The paper relies on this without support.

    Modbus/TCP is an enhanced variation of Modbus that focuses on reliable communication over the Internet and Intranet.

    “Modbus/TCP, an enhanced variation of Modbus is also available which focus on reliable communication over the Internet and Intranet.”

  • The paper relies on this without support.

    DNP3 allows SCADA systems to poll at different frequency while IEC 60870-5-101 polls at the same frequency, which helps in limited bandwidth.

    “DNP3 allows SCADA systems to poll at different frequency while IEC 60870-5-101 poll at the same frequency which helps it is a case of limited bandwidth.”

  • The paper relies on this without support.

    Modbus is a single layer protocol while DNP3 and Foundation Fieldbus use four-layer architecture.

    “Modbus is a single layer protocol while DNP3, Foundation Fieldbus uses four-layer architecture.”

  • The paper relies on this without support.

    Only DNP3-SA and Profibus support encryption and authentication control, while Modbus is an insecure communication protocol.

    “Only DNP3-SA and Profibus support encryption and authentication control, while Modbus is an insecure communication protocol.”

  • The paper relies on this without support.

    IEC-6870-5-101 and IEC 61850 do not support encryption but allow authentication control.

    “IEC-6870-5-101 and IEC 61850 do not support encryption but allow authentication control.”

  • The paper relies on this without support.

    Zigbee range is between 10 to 100 meters line-of-sight depending on environmental characteristics.

    “The range of Zigbee communication is between 10 to 100 meters line-of-sight depending on environmental characteristics.”

  • The paper relies on this without support.

    Zigbee is secured by 128-bit symmetric encryption keys and has a data rate of 250 kbps.

    “In short, it is a low data rate, low-power and low communication range wireless ad hoc network which is secured by 128-bit symmetric encryption keys and data rate of 250 kbps.”

  • The paper relies on this without support.

    LoRA supports long-range communication up to 10 Km and data rate less than 50kbps with low power consumption.

    “It supports long-range communication up to 10 Km and data rate less than 50kbps with low power consumption.”

  • The paper relies on this without support.

    CoAP uses an Efficient XML Interchanges (EXI) data format that leads to a more space efficient protocol.

    “It uses an Efficient XML Interchanges (EXI) data format that leads to a more space efficient protocol.”

  • The paper relies on this without support.

    By default, CoAP is bound to UDP and security is provided using Datagram Transport Layer Security.

    “By default, CoAP is bound to User Datagram Protocol (UDP) and security is provided using Datagram Transport Layer Security.”

  • The paper relies on this without support.

    Most industries do not report cyber-attacks on their control system or SCADA for the sake of their reputation.

    “First, most of the industries do not report cyber-attacks on their control system or SCADA for the sake of their reputation.”

  • The paper relies on this without support.

    The impact of attacks on SCADA systems can vary up to loss of human life.

    “Second, the impact of these attack can vary up to loss of human life.”
21 of 21

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Better domain knowledge provided a strong basis for building simulation environments proposed as various SCADA testbeds able to visualize the stages of a cyber attack, and a toolbox for attack simulation to train and test security mechanisms.

    “The Better domain knowledge, which resulted from aforementioned research, provided a strong basis for building simulation environments that are proposed in form of various SCADA testbeds [57], [177] able to visualize the stages of a cyber attack [178], and a toolbox for attack simulation to train and test the security mechanisms [179]”

    From SCADA Systems With Focus on Continuous Manufacturing and Steel Industry: A Survey on Architectures, Standards, Challenges and Industry 5.0 (2022) · cites this paper as [57]

    Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Human-machine interface vulnerabilities were present in 65% of reviewed SCADA/OT vulnerability cases.

    “| Human-Machine Interface | 65% | Medium | Social engineering, insider threats | Medium |”

    From Cyber-Physical Risk Assessment for U.S. Water Utilities: A Comprehensive Analysis of SCADA and Operational Technology Vulnerabilities (2025) · cites this paper as Yadav & Paul (2021)

    In the section headed “Sixteen reported attacks do not mention the country name” (page unavailable), the review says attackers have mainly focused on high-level systems, including HMIs. It does not report that HMI vulnerabilities occurred in 65% of reviewed SCADA/OT vulnerability cases; a search for “65%” found no matching figure. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • Firmware/software update issues were present in 82% of reviewed SCADA/OT vulnerability cases.

    “| Firmware/Software Updates | 82% | High | Known vulnerability exploitation | Low |”

    From Cyber-Physical Risk Assessment for U.S. Water Utilities: A Comprehensive Analysis of SCADA and Operational Technology Vulnerabilities (2025) · cites this paper as Yadav & Paul (2021)

    The “All components” section says SCADA systems cannot readily be patched because they must run continuously, and “4 Taxonomy of attacks” describes restrictions on upgrades. Neither passage reports that update issues occurred in 82% of reviewed SCADA/OT vulnerability cases; searches for the percentage and related terms found no such figure. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • Authentication weaknesses were present in 89% of reviewed SCADA/OT vulnerability cases.

    “| Authentication Weaknesses | 89% | High | Credential stuffing, default passwords | Medium |”

    From Cyber-Physical Risk Assessment for U.S. Water Utilities: A Comprehensive Analysis of SCADA and Operational Technology Vulnerabilities (2025) · cites this paper as Yadav & Paul (2021)

    The “All components” section (page unavailable) describes authentication vulnerabilities, including shared and default passwords. It does not report that authentication weaknesses were present in 89% of reviewed SCADA/OT vulnerability cases; the 89% figure is unsupported by our copy. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Legacy system integration issues were present in 71% of reviewed SCADA/OT vulnerability cases.

    “| Legacy System Integration | 71% | High | Protocol manipulation, system compromise | Very High |”

    From Cyber-Physical Risk Assessment for U.S. Water Utilities: A Comprehensive Analysis of SCADA and Operational Technology Vulnerabilities (2025) · cites this paper as Yadav & Paul (2021)

    The paper’s “All components” section identifies legacy SCADA software as a security concern, and “4 Taxonomy of attacks” says legacy software leaves components prone to known vulnerabilities. Neither passage, nor the paper’s attack analysis, reports that legacy system integration issues occurred in 71% of reviewed cases. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Listed attack impacts exceed the stated six categories

    Minor

    The six stated impact categories omit Environmental Damage, which Table 3 uses for the Maroochy attack.

  • HIL testbed [108] receives two different classifications

    Minor

    Table 6 labels the hardware-in-the-loop testbed a hybrid model, while the discussion presents the same cited testbed as an example of a virtual-physical testbed. The paper treats hybrid and virtual-physical as separate categories.

  • RISI incident dates conflict with the stated last update

    Minor

    The paper says the RISI database contains incidents recorded through 2017, but later says the database has not been updated since 2015.

  • Blanket claim of no protocol security conflicts with Zigbee description

    Minor

    After discussing communication protocols, the paper says they do not support security features, although it explicitly describes Zigbee as using encryption.

4 of 4

The citation lists haven’t been fetched yet

References 149 · Cited by 261

Research works printed but not linked: 15

  1. Pathak, 2014, Modern SCADA systems, Int. J. Eng. Dev. Res., 2, 1693
  2. Mahapatra, 2015, Analysis of vulnerabilities in the protocols used in SCADA systems, Int. J. Adv. Res.Comput. Eng. Technol., 4
  3. Lu, 2019, Cryptography security designs and enhancements of dnp3-sa protocol based on trusted computing., IJ Netw. Secur., 21, 130
  4. Falliere, 2011, W32.stuxnet dossier, Symantec-Security Response Version 1., 1
  5. Robles, 2008, Vulnerabilities in SCADA and critical infrastructure systems, Int. J. Future Gener. Commun. Netw., 1, 99
  6. Lee, 2014, German steel mill cyber attack, Ind. Control Syst., 1
  7. Garitano, 2011, A review of SCADA anomaly detection systems, 357
  8. Gao, 2020, Omni SCADA intrusion detection using deep learning algorithms, IEEE Internet Things J., 1
  9. Perez, 2019, Forget the myth of the air gap: Machine learning for reliable intrusion detection in SCADA systems, EAI Endorsed Trans. Secur. Saf., 6, e3
  10. Byres, 2012, 12, 2012
  11. Nivethan, 2016, On the use of open-source firewalls in ICS/SCADA systems, Inf. Secur. J., 25, 83
  12. Ghaleb, 2016, SCADA-sst: a SCADA security testbed, Wcicss, 34
  13. Ferrag, 2020, Cyber security for fog-based smart grid SCADA systems: solutions and challenges, J. Inform. Secur. Appl., 52, 102500
  14. Baker, 2020, A secure fog-based platform for SCADA-based IoTcritical infrastructure, Software, 50, 503
  15. Yadav, 2020, Iot-pen: an e2e penetration testing framework for IoT, J. Inf. Process., 28, 633

Authors
Yadav, G., & Paul, K.
Affiliations
Indian Institute of Technology Delhi (IN)
Corresponding author
Yadav, Geeta
ORCID
Venue
International Journal of Critical Infrastructure Protection
Publisher
Elsevier BV
Published
2021-09
Volume
34
Pages
100433
ISSN
1874-5482 (ISSN-L)
DOI
10.1016/j.ijcip.2021.100433
OpenAlex
W3000597176
Semantic Scholar
7520b3b536f5e6c96235107ccd69ade521196d69
Cited by
261
References
149
Citations by year
2026: 40 · 2025: 66 · 2024: 55 · 2023: 47 · 2022: 39 · 2021: 13 · 2020: 1
FWCI
17.14
Type
journal article
Language
en
Open access
Licence
Locations
  • International Journal of Critical Infrastructure Protection (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • RePEc: Research Papers in Economics (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
SCADA systems, industrial control systems, critical infrastructure security, cyberattacks, communication protocols, intrusion detection, Internet of Things, Industrial Internet of Things, security vulnerabilities

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review